* feat(managers/npm): allow specifying `toolSettings.nodeMaxMemory`
As noted in #40942, we're seeing an increase in memory usage across
`pnpm` and `yarn` users in Mend-hosted apps.
To allow limiting the maximum memory that any `node` child processes
will use, we can add a new `toolSettings.nodeMaxMemory` to (hopefully)
mitigate this.
Similar to the `toolSettings.jvmMaxMemory`, the self-hosted
administrator can set a maximum, which cannot be exceeded by repo-level
configuration.
* fixup! feat(managers/npm): allow specifying `toolSettings.nodeMaxMemory`
* fix(gomod): add -modfile flag for non-default go.mod filenames
When using managerFilePatterns to manage non-standard go.mod files
(e.g. tools.mod), the go commands (get, mod tidy, mod vendor) now
include the -modfile flag so they operate on the correct module file
instead of defaulting to go.mod in the working directory
* Update lib/modules/manager/gomod/artifacts.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* Update lib/modules/manager/gomod/artifacts.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* use string templates
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
* feat(swift): update Package.resolved when updating Package.swift
Add artifact support to the Swift Package Manager module so that
Package.resolved lockfiles are updated alongside Package.swift manifest
changes. Uses direct JSON modification (targeted regex replacement of
version and revision within each pin block) instead of requiring the
Swift toolchain, avoiding the need for a macOS runner or private repo
authentication.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(swift): achieve 100% coverage for artifacts.ts
Add tests for missing datasource/packageName, missing pins array, and
getDigest exceptions. Mark three unreachable defensive guards with
istanbul ignore (valid JSON always has matching braces and identities).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(swift): address review feedback from viceice
- Inline test fixtures instead of using fixture files
- Remove unnecessary beforeEach/resetAllMocks
- Use PackageDependency and Upgrade types instead of inline type literals
- Add Zod schema for safe Package.resolved parsing
- Move PackageResolvedPin/PackageResolvedJson types to schema.ts
- Delete fixture files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
As noted in #39559, we should also make it possible to use Renovate's
`toolSettings` to tune the Java Virtual Machine that's used to spawn
Gradle, via the Gradle Wrapper.
This will affect any `gradle` manager invocations, but will not apply to
`postUpgradeTasks`, as this is passed in as a parameter.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* fix(gomod): support non-public module paths in `replace` directives
As noted in #41518, we allow extracting `require` directives that
include a module path that's non-public, so we should also support this
for `replace` directives.
* fixup! fix(gomod): support non-public module paths in `replace` directives
* Support InstallTools methods for cake build files
* Allow dotnet tool extraction in single file cake sdk build scripts
* Fix dependency parsing for InstallTools methods
* Remove unused import
* Fix readme for cake manager
* Add test case to improve coverage
* Update lib/modules/manager/cake/index.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
As a follow-up to #41517, when we have a placeholder pseudo version, we
attempt to look up updates for the module.
However, because these are handled by a `replace` directive, there's no
point attempting to look them up.
Especially, as noted in #41517, this could be a non-public module, so
the lookup will fail unnecessarily.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* test(vendir): avoid hard-to-test branches
As a follow-up to #41443, where it's difficult to test this.
* fixup! test(vendir): avoid hard-to-test branches
As noted in #41260, if a Go module is using a `replace` with both
modules with the same name, the major upgrade fails to produce a valid
`go.mod`, as the `replace` will still partially reference the old
package.
When using Vendir with Git repositories, we do not currently provide
authentication via Host Rules, which means we cannot access private
repositories.
Instead, we should set these, so they can be used by `vendir sync` to
authenticate to private repos.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* feat(vendir): support extracting HTTP sources
As noted in #41435, Vendir's support for HTTP sources would be useful
for Renovate to keep updated.
Instead of managing the updating of files ourselves, we can use Vendir's
existing `lockFileMaintenance` task to do so, where `vendir sync` will
re-fetch the remote file(s) and sync them to the repo.
For this to be supported, we can extract the HTTP sources with
`unsupported-datasource`, so Renovate knows that the dependency is
there, but can't be managed by us.
This makes it possible to extract HTTP dependencies, and then have
Renovate update them through `lockFileMaintenance`.
* fixup! feat(vendir): support extracting HTTP sources
As we're always returning a dependency, we can remove the nullable
return type.
This also allows us to increase test coverage, because we now don't have
code paths that aren't tested.
* Add nuget capability to read packages from cs files
This is useful for dotnet source files that make use
of the .NET 10 feature to have single file projects,
where packages and sdks can be defined in a source
file.
* Add tests to validate that the nuget.config file is respected for single csharp files
* Apply PR linter suggestion for prettier code
* Remove unnecessary try-catch to increase code coverage
* Update phrasing in documentation
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
* Use codeblock instead of fixture
* Remove unused import
* Remove unnecessary fixtures and only verify required methods are called
* Fix imports in single-chsarp-file.ts
* Fix import ordering
* Increase code block indent
---------
Co-authored-by: RahulGautamSingh <rahultesnik@gmail.com>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
As noted in #41215 and #40830, when using the Bun manager in a
repository that has a `.npmrc`, the `.npmrc` is not used.
This is at odds with `bun`'s tooling itself reading from this file, so
we should make it possible to parse + make the `npmrc` available for
usage.
We can add this with our new `resolveNpmrc` function.
We do not need to add in-depth test coverage as this should be handled
by `resolveNpmrc`.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* refactor(manager/npm): extract function for resolving `.npmrc`
As part of future changes in #41215 and/or #41216, we will resolve the
`.npmrc`, if it can be found, in multiple places.
Before we do this, we can prefactor this logic to extract this out into
its own function that can be used independently.
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* test(manager/npm): add missing test coverage
This is coverage that we've never had on this function, and was reported
by CodeCov.
---------
Co-authored-by: Claude Sonnet 4.5 <jamie.tanna+github-copilot@mend.io>
* feat(mise): add support for github backend
* test(mise): remove redundant github backend test
* refactor(mise): flatten nested conditionals in github backend
* refactor(mise): only set extractVersion for custom version_prefix
* refactor(mise): use escapeRegExp and simplify extractVersion spread
* feat(nuget): add supportsLockFileMaintenance flag
The NuGet manager supports lock file maintenance via `packages.lock.json`
but was missing the `supportsLockFileMaintenance` export.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(manager): add lockFileNames metadata to all lock file managers
Add `lockFileNames` field to `ManagerApi` interface and export it from
all 24 managers that support lock file maintenance. This metadata will
be used to auto-generate the lock file support table in docs.
Also adds a validation test ensuring managers with
`supportsLockFileMaintenance` always provide `lockFileNames`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
feat(nuget): add supportsLockFileMaintenance flag
The NuGet manager supports lock file maintenance via `packages.lock.json`
but was missing the `supportsLockFileMaintenance` export.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(vendir): remove registryUrls from git-refs dependencies
The git-refs datasource does not support custom registries
(customRegistrySupport = false). Setting registryUrls on git
dependencies causes a spurious warning in the Renovate dashboard:
'Custom registries are not allowed for this datasource.'
This removes the registryUrls property from extractGitSource since
the git URL is already captured in depName and packageName.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(vendir): remove redundant packageName from git-refs dependencies
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
This change introduces a heap size limitation for the Gradle daemon used
when updating the Gradle wrapper, defaults to 512m.
The heap size is limited to the globally configured limit, which
defaults to 512m. It can be configured on the repository level, but not
exceed the globally configured limit. A hard coded mimiumum heap size of
512m is enforced.
The configuration option is named `toolSettings`, which has two
properties for the maximum and initial heap size. See
`docs/usage/configuration-options#toolSettings` for more details.
As a safety measure for self-hosted administrators, we can make sure
that we set `allowedUnsafeExecutions` to not allow any commands by
default.
This closes off a significant risk of executing Gradle Wrapper
commands, which use the repository's copy of the wrapper, and any
Gradle buildscript, when executing, which can lead to significant remote
code execution, even before you take into account malicious dependencies.
As this is now off-by-default, we can enable it by default in our tests
to make sure that there are minimal changes required.
As noted in #40774, if a `pnpm-lock.yaml` isn't found, the
`pnpmShrinkwrap` is undefined, which then results in `upath.dirname`
throwing an error.
We can make sure that we have a value, and exit out early if not.
This is a short-term fix, and we should follow-up to make it so we can
find the `pnpm-workspace.yaml` if there's not a lockfile.
Jamie Tanna